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Abstract 

A quantum key distribution scheme whose security depends on the 
features of pre- and post-selected quantum states is described. 



PACS numbers: 3.67.Dd, 03.65.Bz 

1 Introduction 

A wide variety of quantum key distribution schemes have been proposed, fol- 
lowing the original Bennett and Brassard protocol || . Ekert [Q has described 
a scheme in which two parties, Alice and Bob, create a shared random key 
by performing spin measurements on pairs of spin-| particles in the singlet 
state. The particle pairs are emitted by a source towards Alice and Bob, 
who each measure spin along three different directions, chosen randomly and 
independently for each pair. After a sequence of measurements on an ap- 
propriate number of pairs, Alice and Bob announce the directions of their 
measurements publicly and divide the measurements into two groups: those 
in which they measured the spin in different directions, and those in which 
they measured the spin in the same direction. They publicly reveal the out- 
comes of the first group of measurements and use these to check that the 
singlet states have not been disturbed by an eavesdropper, Eve. Essentially, 
they calculate a correlation coefficient: any attempt by Eve to monitor the 
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particles will disturb the singlet state and result in a correlation coefficient 
that is bounded by Bell's inequality and is hence distinguishable from the 
correlation coefficient for the singlet state. If Alice and Bob are satisfied that 
no eavesdropping has occurred, they use the second group of (oppositely cor- 
related) measurement outcomes as the raw key. 

The Ekert scheme solves the key distribution problem as well as the key 
storage problem, because there is no information in the singlets before Alice 
and Bob perform their measurements and communicate classically to estab- 
lish the key. The scheme proposed here also involves entangled states, but 
the test for eavesdropping is different. Instead of a statistical test based on 
Bell's theorem, the test exploits conditional statements about measurement 
outcomes generated by pre- and post-selected quantum states. 



2 Pre- and post-selected quantum states 

The peculiar features of pre- and post-selected quantum states were first 
pointed out by Aharonov, Bergmann, and Lebowitz |]]. If (1) Alice prepares a 
system in a certain state |pre) at time t±, (2) Bob measures some observable Q 
on the system at time t 2 , and (3) Alice measures an observable of which |post) 
is an eigenstate at time t 3 , and post-selects for |post), then Alice can assign 
probabilities to the outcomes of Bob's Q-measurement at t 2 , conditional on 
the states |pre) and |post) at times t\ and £3, respectively, as follows fl], [/J: 

I (pre I P fc I post) | 2 
PIOb( * ) = E,l(pre|P,|po 8 t)P « 

where Pi is the projection operator onto the i'th eigenspace of Q. Notice 
that ([I]) — referred to as the 'ABL-rule' (Aharonov-Bergmann-Lebowitz rule) 
in the following — is time-symmetric, in the sense that the states |pre) and 
|post) can be interchanged. 

If Q is unknown to Alice, she can use the ABL-rule to assign probabilities 
to the outcomes of various hypothetical Q-measurements. The interesting 
peculiarity of the ABL-rule, by contrast with the usual Born rule for pre- 
selected states, is that it is possible — for an appropriate choice of observables 
Q, Q', . . . , and states |pre) and |post) — to assign unit probability to the 
outcomes of a set of mutually noncommuting observables. That is, Alice can 
be in a position to assert a conjunction of conditional statements of the form: 
'If Bob measured Q, then the outcome must have been qi, with certainty, and 
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if Bob measured Q', then the outcome must have been q'-, with certainty, . . . ,' 
where Q,Q', . . . are mutually noncommuting observables. Since Bob could 
only have measured at most one of these noncommuting observables, Alice's 
conditional information does not, of course, contradict quantum mechanics: 
she only knows the eigenvalue qi of an observable Q if she knows that Bob 
in fact measured Q. 

Vaidman, Aharonov, and Albert [^] discuss a case of this sort, where the 
outcome of a measurement of any of the three spin components a x , a y , a z of 
a spin-| particle can be inferred from an appropriate pre- and post-selection. 
Alice prepares the Bell state: 

|pre> = -^=(| \ z )a\ U)c + I U)a\ U)c (2) 

where | ] z ) and | [ z ) denote the <r z -eigenstates. Alice sends one of the 
particles — the channel particle, denoted by the subscript C — to Bob and 
keeps the ancilla, denoted by A. Bob measures either a x , or a y , or a z on the 
channel particle and returns the channel particle to Alice. Alice then mea- 
sures an observable R on the pair of particles, where R has the eigenstates: 



ri) = 
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Note that: 












|pre) 


= ^(IT,>|T«> + U«>U*> 
= -L(| Tx )|t,) + IUIU 

= ^(|ty>U»> + Uy>|Ty> 
= + |r 2 ) + \r 3 ) + |r 4 ))' 
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In Eqs. (PD-flTDD and in the following, the subscripts A and C appearing in 
Eq. (0) are implicit in the tensor product notation. Eqs. fl8D-(fL0|) correspond 
to Eq. (2) of or Eq. (54) of §. 

Alice can now assign values to the outcomes of Bob's spin measurements 
via the ABL-rule, whether Bob measured a x , a y , or a z , based on the post- 
selections \r\), |r 2 ), |r 3 ), or |r 4 ), according to Table [I] (where represents the 
outcome f and 1 represents the outcome j.) 0: 
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Table 1: cr x , a y , o z measurement outcomes correlated with eigenvalues of R 



3 The key distribution protocol 

This case can be exploited to enable Alice and Bob to share a private ran- 
dom key in the following way: Alice prepares a certain number of copies 
(depending on the length of the key and the level of privacy desired) of the 
Bell state, Eq. (H). She sends the channel particles to Bob in sequence and 
keeps the ancillas. Bob measures a x or a z randomly on the channel particles 
and returns the particles, in sequence, to Alice. Alice then measures the 
observable R on the ancilla and channel pairs and divides the sequence into 
two subsequences: the subsequence Sx4 f° r which she obtained the outcomes 
ri or r 4 , and the subsequence £23 for which she obtained the outcomes r 2 or 
r 3 . The sequence of quantum operations can be implemented on a quantum 
circuit as in Fig. p] (see Eq. (46) of Metzger ||). In the present work, an 
ideal system without noise is assumed. 

To check that the channel particles have not been monitored by Eve, Alice 
now publicly announces the indices of the subsequence 6*23. As is evident 
from Table [1], for this subsequence she can make conditional statements of 
the form: 'For channel particle i, if a x was measured, the outcome was 1 (0), 
and if a z was measured, the outcome was (1),' depending on whether the 
outcome of her Z?-measurement was r 2 or r 3 . She announces these statements 
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Figure 1: Quantum circuit for key distribution protocol 

publicly. If one of these statements, for some index i, does not agree with 
Bob's records, Eve must have monitored the i'th channel particle. (Of course, 
agreement does not entail that the particle was not monitored.) 

For suppose Eve measures a different spin component observable than 
Bob on a channel particle and Alice subsequently obtains one of the eigen- 
values r 2 or r 3 when she measures R. Bob's measurement outcome, either 
or 1, will be compatible with just one of these eigenvalues, assuming no 
intervention by Eve. But after Eve's measurement, both of these eigenvalues 
will be possible outcomes of Alice's measurement. So Alice's retrodictions 
of Bob's measurement outcomes for the subsequence S23 will not necessarily 
correspond to Bob's records. In fact, it is easy to see that if Eve measures a x 
or a z randomly on the channel particles, or if she measures a particular one 
of the observables a x , a y , or a z on the channel particles (the same observable 
on each particle), the probability of detection in the subsequence S23 is 3/8. 

In the subsequence S u , the and 1 outcomes of Bob's measurements 
correspond to the outcomes r\ and r 4 of Alice's ^-measurements. If, following 
their public communication about the subsequence S23, Alice and Bob agree 
that there has been no monitoring of the channel particles by Eve, they use 
the subsequence S14 to define a shared raw key. 

Note that even a single disagreement between Alice's retrodictions and 
Bob's records is sufficient to reveal that the channel particles have been mon- 
itored by Eve. This differs from the eavesdropping test in the Ekert protocol. 
Note also that Eve only has access to the channel particles, not the parti- 
cle pairs. So no strategy is possible in which Eve replaces all the channel 
particles with her own particles and entangles the original channel particles, 
treated as a single system, with an ancilla by some unitary transformation, 
and then delays any measurements until after Alice and Bob have communi- 
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cated publicly. There is no way that Eve can ensure agreement between Alice 
and Bob without having access to the particle pairs, or without information 
about Bob's measurements. 

The key distribution protocol as outlined above solves the key distribu- 
tion problem but not the key storage problem. If Bob actually makes the 
random choices, measures a x or a z , and records definite outcomes for the spin 
measurements before Alice measures R, as required by the protocol, Bob's 
measurement records — stored as classical information — could in principle be 
copied by Eve without detection. In that case, Eve would know the raw key 
(which is contained in this information), following the public communication 
between Alice and Bob to verify the integrity of the quantum communication 
channel. 

To solve the key storage problem, the protocol is modified in the following 
way: Instead of actually making the random choice for each channel parti- 
cle, measuring one of the spin observables, and recording the outcome of 
the measurement, Bob keeps the random choices and the spin measurements 
'at the quantum level' until after Alice announces the indices of the subse- 
quence 5*23 of her R measurements. To do this, Bob enlarges the Hilbert 
space by entangling the quantum state of the channel particle via a unitary 
transformation with the states of two ancilla particles that he introduces. 
One particle is associated with a Hilbert space spanned by two eigenstates, 
\c a ( x )) and |c CT ( z )), of a choice observable C. The other particle is associated 
with a Hilbert space spanned by two eigenstates, |pf) and \pi), of a pointer 
observable P. (See ||, footnote t, or for details of how to implement the 
unitary transformation on the enlarged Hilbert space.) 

On the modified protocol (assuming the ability to store entangled states 
indefinitely), Alice and Bob share a large number of copies of an entangled 4- 
particle state. When they wish to establish a random key of a certain length, 
Alice measures R on an appropriate number of particle pairs in her possession 
and announces the indices of the subsequence 5*23. Before Alice announces the 
indices of the subsequence S23, neither Alice nor Bob have stored any classical 
information. So there is nothing for Eve to copy. After Alice announces the 
indices of the subsequence S23, Bob measures the observables D and P on 
his ancillas with these indices and announces the eigenvalue |pf) or |pj_) as 
the outcome of his (j(x) or a(z) measurement, depending on the eigenvalue 
of D. If Alice and Bob decide that there has been no eavesdropping by Eve, 
Bob measures D and P on his ancillas in the subsequence S14. It is easy 
to see that the ABL-rule applies in this case, just as it applies in the case 
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where Bob actually makes the random choice and actually records definite 
outcomes of his cr(x) or o~(z) measurements before Alice measures R. (In 
fact, if the two cases were not equivalent for Alice — if Alice could tell from 
her i?-measurements whether Bob had actually made the random choice and 
actually performed the spin measurements, or had merely implemented these 
actions 'at the quantum level' — the difference could be exploited to signal 
superluminally.) 

There are clearly other possible ways of exploiting this case to implement 
a secure key distribution protocol (involving all three spin component observ- 
ables, for example), but the principle is similar. It would seem worthwhile 
to consider whether other applications of pre- and post-selection might be 
applied as a tool in quantum cryptology. 
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